Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
snort ET WEB_SPECIFIC_APPS Fork-CMS js.php module parameter Local File Inclusion Attempt rev 2 2012-03-06
snort ET ACTIVEX ASUS Net4Switch ActiveX CxDbgPrint Format String Function Call Attempt rev 2 2012-03-06
snort ET TROJAN W32/Backdoor.BlackMonay Checkin rev 2 2012-03-05
snort ET TROJAN W32/TCYWin.Downloader User-Agent rev 1 2012-03-05
snort ET TROJAN W32/Koobface Variant Checkin Attempt rev 1 2012-03-05
snort ET CURRENT_EVENTS DRIVEBY Java Atomic Exploit Downloaded rev 4 2012-03-01
snort ET WEB_SERVER eval/base64_decode Exploit Attempt Inbound rev 2 2012-03-01
snort ET TROJAN Backdoor.Win32.PEx.942728546 Checkin rev 1 2012-02-29
snort ET CURRENT_EVENTS DRIVEBY Java Rhino Scripting Engine Exploit Downloaded rev 3 2012-02-29
snort ET WEB_SPECIFIC_APPS pfile file.php id Parameter SELECT FROM SQL Injection Attempt rev 2 2012-02-21
snort ET POLICY Http Client Body contains pword= in cleartext rev 2 2012-02-21
snort ET POLICY Http Client Body contains pwd= in cleartext rev 2 2012-02-21
snort ET WEB_SPECIFIC_APPS pfile file.php id Parameter DELETE FROM SQL Injection Attempt rev 2 2012-02-21
snort ET WEB_SPECIFIC_APPS Horde 3.3.12 Backdoor Attempt rev 2 2012-02-21
snort ET WEB_SPECIFIC_APPS pfile file.php id Parameter UNION SELECT SQL Injection Attempt rev 2 2012-02-21
snort ET POLICY Http Client Body contains passwd= in cleartext rev 2 2012-02-21
snort ET POLICY Http Client Body contains passphrase= in cleartext rev 2 2012-02-21
snort ET WEB_SPECIFIC_APPS pfile file.php id Parameter INSERT INTO SQL Injection Attempt rev 2 2012-02-21
snort ET WEB_SPECIFIC_APPS pfile file.php id Parameter UPDATE SET SQL Injection Attempt rev 2 2012-02-21
snort ET TROJAN Query for Known Hostile *test.3322.org.cn Domain rev 1 2012-02-21
snort ET POLICY HTTP POST contains pass= in cleartext rev 2 2012-02-21
snort ET WEB_SPECIFIC_APPS Joomla com_visa controller Local File Inclusion Attempt rev 2 2012-02-21
snort ET TROJAN W32.Duptwux/Ganelp FTP Username - onthelinux rev 1 2012-02-18
snort ET MOBILE_MALWARE XML Style POST Of IMEI International Mobile Equipment Identity rev 6 2012-02-12
snort ET POLICY File Being Uploaded to SendSpace File Hosting Site rev 1 2012-02-07
snort ET TROJAN MSUpdater Connectivity Check to Google rev 1 2012-02-07
snort ET POLICY Outbound HTTP Connection From Cisco IOS Device rev 1 2012-02-07
snort ET MOBILE_MALWARE Android/Plankton.P Commands Request to CnC Server rev 1 2012-02-07
snort ET TROJAN MSUpdater alt checkin to CnC rev 1 2012-02-07
snort ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter SELECT FROM SQL Injection Attempt rev 2 2012-02-06
snort ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter UNION SELECT SQL Injection Attempt rev 2 2012-02-06
snort ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter INSERT INTO SQL Injection Attempt rev 2 2012-02-06
snort ET WEB_SPECIFIC_APPS IBBY nouvelles.php id Parameter DELETE FROM SQL Injection Attempt rev 2 2012-02-06
snort GPL NETBIOS DCERPC LSASS bind attempt rev 8 2012-01-31
snort GPL NETBIOS DCERPC LSASS direct bind attempt rev 8 2012-01-31
snort GPL NETBIOS SMB DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt rev 10 2012-01-31
snort GPL MISC HP Web JetAdmin file write attempt rev 2 2012-01-31
snort GPL SCAN nessus 2.x 404 probe rev 2 2012-01-31
snort GPL P2P eDonkey server response rev 4 2012-01-31
snort GPL NETBIOS SMB-DS DCERPC LSASS bind attempt rev 8 2012-01-31